Security analysis is a topic of great importance for application program development. In many cases, security analysis for an application program is reduced to a data-flow problem. The application program that is undergoing security testing is represented as a data-flow graph. Representing the application program as a series of data-flows allows one to observe the flow of data into and out from various areas of the application program (or computing environment) to better identify security vulnerabilities.
Examples of security vulnerabilities include those relating to system integrity and data confidentiality. An integrity-related vulnerability involves the flow of data from an untrusted source to a security-sensitive area of the application program. A confidentiality-related vulnerability relates to the flow of trusted data into a public or unprotected area of the application program which may allow untrusted third parties to access the data.
A number of factors impede security analysis. One factor is the large scale of modern application programs such as Web-based applications, network-based applications, and the like. Tracking data-flows through such large systems is difficult. Another factor is the use of data structures, referred to as “containers,” which tend to obfuscate the flow of data within the application program under test. In many cases, it is not feasible to accurately tracking a data-flow through a container due to significant complexity of the container. These impediments to security analysis often result in the test system generating one or more false positives for security vulnerabilities when testing program code.